From 616a4d385a79d6809b618dcc8bcbda05b032d5fc Mon Sep 17 00:00:00 2001 From: Tim Graham Date: Mon, 19 Aug 2013 09:35:26 -0400 Subject: [1.5.x] Fixed #20922 -- Allowed customizing the serializer used by contrib.sessions Added settings.SESSION_SERIALIZER which is the import path of a serializer to use for sessions. Thanks apollo13, carljm, shaib, akaariai, charettes, and dstufft for reviews. Backport of b0ce6fe656 from master --- docs/ref/settings.txt | 28 +++++++++++++++++++++++++++- 1 file changed, 27 insertions(+), 1 deletion(-) (limited to 'docs/ref') diff --git a/docs/ref/settings.txt b/docs/ref/settings.txt index 64f269a553..fc3f33904c 100644 --- a/docs/ref/settings.txt +++ b/docs/ref/settings.txt @@ -1444,6 +1444,8 @@ Sets the minimum message level that will be recorded by the messages framework. See the :doc:`messages documentation ` for more details. +.. setting:: MESSAGE_STORAGE + MESSAGE_STORAGE --------------- @@ -1817,7 +1819,7 @@ SESSION_ENGINE Default: ``django.contrib.sessions.backends.db`` -Controls where Django stores session data. Valid values are: +Controls where Django stores session data. Included engines are: * ``'django.contrib.sessions.backends.db'`` * ``'django.contrib.sessions.backends.file'`` @@ -1859,6 +1861,30 @@ Default: ``False`` Whether to save the session data on every request. See :doc:`/topics/http/sessions`. +.. setting:: SESSION_SERIALIZER + +SESSION_SERIALIZER +------------------ + +.. versionadded:: 1.5.3 + +Default: ``'django.contrib.sessions.serializers.PickleSerializer'`` + +Full import path of a serializer class to use for serializing session data. +Included serializers are: + +* ``'django.contrib.sessions.serializers.PickleSerializer'`` +* ``'django.contrib.sessions.serializers.JSONSerializer'`` + +See :ref:`session_serialization` for details, including a warning regarding +possible remote code execution when using +:class:`~django.contrib.sessions.serializers.PickleSerializer`. + +In Django 1.5.3, the default in newly created projects using +:djadmin:`django-admin.py startproject ` is +:class:`django.contrib.sessions.serializers.JSONSerializer`, and the global +default will switch to this class in Django 1.6. + .. setting:: SHORT_DATE_FORMAT SHORT_DATE_FORMAT -- cgit v1.3